Now that Windows Server has built-in OpenSSH server, does Windows updates install patches / version upgrades for this OpenSSH server too?

Question

As title.

We are using Win2019. Although you need to do some one-off extra steps to install/enable the SSH server feature, I consider this as a built-in feature that comes with Windows.

I checked the registered services in Windows, learned that it is in fact a OpenSSH installed in c:\Windows\System32\OpenSSH folder.

From one of our Win2019 servers with latest Windows Updates installed (as at Dec2023), I see that the installed OpenSSH version info is,

Product name: OpenSSH for Windows

File version: 7.7.2.2

Product version: OpenSSH_7.7p1 for Windows

For reference, the latest version from openssh.com is 9.6

https://www.openssh.com/

There might be different branches, I don't know (e.g. for Windows and for Linux?). No matter what, my concerns is, do I need to take care of security patches, version upgrades (also for security reason) of this built-in OpenSSH server, or Win2019's Windows Updates will take care of it for me?

Answer 1

Yes, Latest Cumulative Update updates all Windows Features on Demand (AKA capabilities)

Answer 2

Hello,

Thank you for posting in Q&A forum.

Yes, it would be updated via Microsoft updates as part of the operating system.

The OpenSSH open source project is managed by developers at the OpenBSD Project. The Microsoft fork of this project is in GitHub( https://github.com/PowerShell/openssh-portable ).

You can check below link for reference:

https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview

I hope this helps! Let me know if you have any other questions.

Answer 3

This is not correct that Windows Updates will keep it up to date. I run Windows updates on a regular 2 and 4th weekly basis every month, on both Windows 2019 and 2022 servers and can confidently say, Windows Updates does NOT update OpenSSH.

I installed it via windows features, and got 8.1 on 2022 and 7.x on 2019, this is several months ago now and still, Windows Updates has not updated it.

I had to manually remove the older versions, and get the latest one from GitHub from the Official GitHub and even then, that is not the latest version of OpenSSH and install it.

This is really, really bad for a built-in management tool, this should be managed and updated regularly both in GitHub as well as the update schedule, but its not.

Answer 4

Take this latest version of OpenSSH and the vulnerabilities it fixes for example, will we get patch for them by Windows Updates anytime soon?

https://www.openssh.com/txt/release-9.8

If we won't get official answer here, where/who should I ask?